OS ポリシーは、パッケージ、リポジトリ、ファイルなどの OS リソースや、スクリプトで定義されたカスタム リソースの宣言型構成を含むファイルです。
1 つの OS リソースで、エージェントのインストールなどの単一タスクを実行できます。また、変更を行わずに別の割り当てで再利用することもできます。複数の OS リソースを 1 つの OS ポリシーにまとめることで、マルチステップのワークフローを作成できます。たとえば、1 つの OS ポリシーに、リポジトリを設定する 1 つのリソースと、そのリポジトリから特定のパッケージをインストールするもう一つのリソースを含めることができます。
OS ポリシーの割り当ては、VM Manager が OS ポリシーを VM に適用するために使用します。OS ポリシーの割り当てを使用すると、複数の OS ポリシーを組み合わせて、ラベル、OS ファミリー、ゾーンなどのフィルタを使用し、VM の動的なグループにターゲットを設定できます。
たとえば、テスト環境内のすべての Ubuntu VM に 3 つのポリシーを適用し、Google Kubernetes Engine を実行している VM には適用しない OS ポリシーの割り当てを作成するには、次のものを指定します。
ポリシー A: Monitoring エージェントをインストールする
ポリシー B: Logging エージェントをインストールする
ポリシー C: セキュリティ エージェントをインストールする
対象ラベル: env:test
除外ラベル: goog-gke-node
OS ファミリー: ubuntu
ロールアウト
新しい OS ポリシーの割り当てを作成すると、VM Manager はロールアウト構成に従って OS ポリシーを各 VM に適用します。ロールアウト中、各 OS ポリシーのコピーが VM に配置されます。OS ポリシーの割り当てを更新すると、VM Manager はターゲット VM 上にある OS ポリシーの構成の変更を確認し、適用します。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-09-04 UTC。"],[[["\u003cp\u003eOS policies automate the deployment, configuration, maintenance, and reporting of software configurations on virtual machine (VM) instances.\u003c/p\u003e\n"],["\u003cp\u003eOS policies are used to manage tasks such as installing and maintaining agents, deploying security agents, managing files, running compliance checks, and executing condition-based scripts.\u003c/p\u003e\n"],["\u003cp\u003eOS policy assignments combine multiple OS policies and target them to dynamic groups of VMs by using filters like labels, OS families, and zones.\u003c/p\u003e\n"],["\u003cp\u003eRollouts enable pacing of configuration changes and controlling the speed of configuration deployments, using wave size and wait time settings to mitigate disruptions.\u003c/p\u003e\n"],["\u003cp\u003eVM Manager uses OS Config agents on VMs to apply changes specified in OS policies, with a periodic enforcement check every 60 minutes.\u003c/p\u003e\n"]]],[],null,["This page provides an overview of OS policies. Use OS policies to automate and centralize the\ndeployment, configuration, maintenance, and reporting of software configurations\non your virtual machine (VM) instances.\n\nUse cases\n\nOS policies are ideal for the following scenarios:\n\n- Installing and maintaining agents for tasks such as monitoring and logging\n- Deploying agents such as security agents, and ensuring that these agent are running on all VMs\n- Improving startup script flexibility. With OS policies you can modify existing scripts and re-deploy them\n- Running compliance checks\n- Adding update repositories for software packages\n- Managing files on the operating system\n- Running condition-based scripts. You can set up scripts that run based on certain conditions to maintain consistent state within the operating system.\n\n| **Note:** Custom OS policy scripts and output files that you define using the [`Exec`](/compute/docs/osconfig/rest/v1/projects.locations.osPolicyAssignments#exec) resource don't use [customer-managed encryption keys (CMEKs)](/kms/docs/cmek). These OS policies are incompatible with Google Cloud's [Access\n| Transparency](/assured-workloads/access-transparency/docs/overview) and [Access\n| Approval](/assured-workloads/access-approval/docs/overview). Make sure that you don't include any sensitive information in these scripts or output files.\n\nComponents\n\nOS policy\n\nAn OS policy is a file that contains the declarative configuration for OS\nresources such as packages, repositories, files, or custom resources defined by\nscripts.\n\nAn OS resource can perform a single task such as installing an agent and can be\nreused without changes in different assignments.\nYou can create a multi-step workflow by combining multiple OS resources into a single\nOS policy. For example, an OS policy can have one resource that sets up a repository\nand a second resource that installs specific packages from that repository.\n\nFor more information about OS policies, see\n[OS policy and OS policy assignment](/compute/vm-manager/docs/os-policies/working-with-os-policies).\n\nOS policy assignment\n\nOS policy assignments are used by VM Manager to apply your OS policies to\nVMs. Use OS policy\nassignments to combine multiple OS policies and target them to a dynamic group\nof VMs by using filters such as labels, OS families, and zones.\n\nFor example, an OS policy assignment that applies three policies\nto all the Ubuntu VMs in your test environment, while excluding those that are\nrunning Google Kubernetes Engine, can be created by specifying the following:\n\n- Policy A: install monitoring agent\n- Policy B: install logging agent\n- Policy C: install security agent\n- Include label: `env:test`\n- Exclude label: `goog-gke-node`\n- OS family: `ubuntu`\n\n| **Note:** OS policy assignments are zonal resources. One assignment can target multiple VMs in a single zone. For more information about zonal resources, see [Zonal resources](/compute/docs/regions-zones/global-regional-zonal-resources#zoneresource).\n\nRollouts\n\nWhen you create a new OS policy assignment, VM Manager applies the\nOS policies to each VM according to the rollout configuration. During the rollout,\na copy of each OS policy is placed on the VM. When you update an OS policy assignment,\nVM Manager checks and enforces the configuration changes for the\nOS policy that is on the target VM.\n\nWe recommend that you apply new configuration changes slowly to ensure that\nyou have time to identify any potential disruptions that might be caused\nby configuration changes. This provides you with time needed to cancel\nthe rollout and address the issue.\n\nSpecifying the rollout option enables you to pace configuration changes and\ncontrol the speed of configuration deployments. Each operation for\nan OS policy assignment starts a rollout process. Operations include the creation,\nupdate, or deletion of an OS policy assignment.\n\nYou can use the rollout option to set the following:\n\n- Wave size (disruption budget): the fixed number or percentage of VMs that can experience a rollout at one time. This means that at any moment of the rollout only a specified number of VMs are targeted.\n- Wait time: the time between when the service applies policies to the VM and when a VM is removed from the disruption threshold. For example, a wait time of 15 minutes means that the rollout process must wait 15 minutes after applying the policies to a VM before it can remove the VM from the disruption threshold and the rollout can proceed. The wait time helps control the speed of a rollout and also lets you catch and resolve potential rollout issues early. Select a time that is long enough for you to monitor the status of your rollouts.\n\nFor information about how to create OS policy assignments, see\n[Creating an OS policy assignment](/compute/vm-manager/docs/os-policies/create-os-policy-assignment).\n\nOS Config agent\n\nDuring VM Manager setup, OS Config agents are enabled on the VMs in\nyour project. The OS Config agents that are running on these target VMs use\nstandard system utilities to apply the changes that are specified in the\nOS policies.\n\n- Linux VMs run system package managers such as `apt` or `yum` for package installation, or `/bin/sh` for scripting.\n- Windows VMs run `googet` package manager and PowerShell for scripting.\n\nFor information about how to set up VM Manager,\nsee [Setting up VM Manager](/compute/vm-manager/docs/setup#overview).\n\nHow OS policies work\n\nTo use OS policies for maintaining your operating systems, do the following:\n\n1. Create or download OS policies\n2. Create OS policy assignments that applies these OS policies to the target VMs\n\n[](/static/compute/images/os-config/os-configuration-arch.png) Figure 1. OS policies architecture overview\n\nAfter the OS policy assignments are created, VM Manager periodically\nchecks and enforces these OS policies. The time interval between each\nenforcement check is 60 minutes.\n\nDuring the check and enforcement, VM Manager completes the\nfollowing steps:\n\n1. Identifies the OS policy assignments for a VM.\n2. Identifies the OS policies associated with the OS policy assignments.\n3. Sends the information for each OS policy to the OS Config agent that is running on the VM.\n4. The OS Config agent then validates each policy and makes the following\n updates:\n\n - If resources within an OS policy are already in their desired state, then the OS Config agent does not perform any actions\n - If resources within an OS policy are not in their desired state, then the OS Config agent takes appropriate actions to bring the resources to the desired state\n5. Collects the compliance status of each OS policy that is applied to the VM.\n To view compliance reports, see\n [View compliance reports](/compute/vm-manager/docs/os-policies/view-compliance).\n\nPricing\n\nFor information about pricing, see\n[VM Manager pricing](/compute/vm-manager/pricing).\n\nWhat's next?\n\n- Review [OS policy and OS policy assignment](/compute/vm-manager/docs/os-policies/working-with-os-policies).\n- Learn how to [create an OS policy assignment](/compute/vm-manager/docs/os-policies/create-os-policy-assignment).\n- Learn how to [manage OS policy assignments](/compute/vm-manager/docs/os-policies/manage-os-policy)."]]
